I have written a post or two about the virtual worlds such as World of Warcraft and Second Life [see Connecting America & China and “Virtually” No Escape]. Second Life has certainly lived up to its name. It has spawned communities, businesses, economies, advertising, and now, even a criminal element [“Spies’ Battleground Turns Virtual,” by Robert O’Harrow, Jr., Washington Post, 6 February 2008].
“U.S. intelligence officials are cautioning that popular Internet services that enable computer users to adopt cartoon-like personas in three-dimensional online spaces also are creating security vulnerabilities by opening novel ways for terrorists and criminals to move money, organize and conduct corporate espionage. Over the last few years, ‘virtual worlds’ such as Second Life and other role-playing games have become home to millions of computer-generated personas known as avatars. By directing their avatars, people can take on alternate personalities, socialize, explore and earn and spend money across uncharted online landscapes. Nascent economies have sprung to life in these 3-D worlds, complete with currency, banks and shopping malls. Corporations and government agencies have opened animated virtual offices, and a growing number of organizations hold meetings where avatars gather and converse in newly minted conference centers. Intelligence officials who have examined these systems say they’re convinced that the qualities that many computer users find so attractive about virtual worlds — including anonymity, global access and the expanded ability to make financial transfers outside normal channels — have turned them into seedbeds for transnational threats.”
This should be a concern for both the benign user and the virtual world provider. Wherever crime breeds you can bet that government involvement isn’t far behind — and that is generally not a good thing for cyber activities.
“‘The virtual world is the next great frontier and in some respects is still very much a Wild West environment,’ a recent paper by the government’s new Intelligence Advanced Research Projects Activity said. ‘Unfortunately, what started out as a benign environment where people would congregate to share information or explore fantasy worlds is now offering the opportunity for religious/political extremists to recruit, rehearse, transfer money, and ultimately engage in information warfare or worse with impunity.’ The government’s growing concern seems likely to make virtual worlds the next battlefield in the struggle over the proper limits on the government’s quest to improve security through data collection and analysis and the surveillance of commercial computer systems.”
If O’Harrow is right, real battles could be fought in these virtual spaces.
“Virtual worlds could also become an actual battlefield. The intelligence community has begun contemplating how to use Second Life and other such communities as platforms for cyber weapons that could be used against terrorists or enemies, intelligence officials said. One analyst suggested beginning tests with so-called teams of cyber warfare experts. The IARPA paper concurred: ‘What additional things are possible in the virtual world that cannot be done in the real world? The [intelligence community] needs to “red team” some possible scenarios of use.’ The CIA has created a few virtual islands for internal use, such as training and unclassified meetings, government officials said. Some veterans of privacy debates said they believe that law enforcement and national security authorities are preparing to make a move, through coercion or new laws, to gain access to the giant computer servers where virtual worlds reside. Jim Dempsey, policy director at the Center for Democracy and Technology, a nonpartisan group that monitors privacy issues, said he heard the same worries from the government when cell phones became popular in the 1980s and again when mainstream American logged on to the Internet in the 1990s. Dempsey said the national security fears are overblown, in part because the country already has legal and technical mechanisms in place to give the government access to digital records it needs.”
Red teaming is always a good idea for national security and citizens expect their governments to do everything possible (within legal and ethical limits) to protect them. Monitoring these virtual spaces, however, generates the same tensions between security and civil liberties that have been raised in other telecommunications area. The intelligence community’s concerns go beyond civil liberty issues; they are concerned that even allowable monitoring efforts are going to be difficult because of how these virtual worlds operate and the expected number people using them in the future.
“Questions about the impact of innovations in communications technology are nothing new. Criminals, terrorists and others have used Web sites for more than a decade to recruit, operate scams and trade pornography. Law enforcement and intelligence authorities responded to new technologies by repeatedly seeking out new surveillance authorities. Intelligence officials said, however, that the spread of virtual worlds has created additional challenges because commercial services do not keep records of communication among avatars. Because of the nature of the systems, the companies also have almost no way of monitoring the creation and use of virtual buildings and training centers, some of them protected by nearly unbreakable passwords. ‘Virtual environments provide many opportunities to exchange messages in the clear without drawing unnecessary attention,’ the IARPA paper said. ‘Additionally, there are many private channels that can be employed to exchange secret messages.’ And there are the numbers. Some marketers and technology observers are predicting explosive growth in the use of virtual worlds in coming years. As more people create avatars, it will become harder to identify bad guys, intelligence officials said. As in the real world, one of the central difficulties is establishing the identity of individuals.”
The next step, according some of those creating virtual worlds, is to make it possible for avatars to travel from one virtual world to another.
“One such world, called HiPiHi, is being created in China. HiPiHi founders said they want to create ways for avatars to be able to travel freely between its virtual world, Second Life and other systems — a development that intelligence officials say make it doubly hard to track down the identity of avatars. In promotional material, HiPiHi officials said that they believe that virtual worlds ‘are the next phase of the Internet.'”
That makes me wonder whether the creators of virtual worlds will get caught up in debates about illegal immigration! Virtual visas may be coming. Creators of virtual worlds are trying to ensure intelligence and law enforcement officials that they need not worry about activity that takes place there.
“The popularity of virtual worlds has grown despite the technology being in an early stage of development. The systems don’t work well on older computers or those with relatively slow connections to the Internet. Though Second Life has more than 12 million registered users, only about 10 percent of those accounts are active. About 50,000 people around the world are on the system at a given moment, according to Linden Lab, which operates Second Life. Officials from Linden Lab have initiated meetings with people in the intelligence community about virtual worlds. They try to stress that systems to monitor avatar activity and identify risky behavior are built into the technology, according to Ken Dreifach, Linden’s deputy general counsel. Dreifach said that all financial transactions are reviewed electronically, and some are reviewed by people. For investigators, there also are also plenty of trails that avatars and users leave behind.”
Despite such assurances, there is no way of predicting how virtual worlds will grow and change in the future. I’m pretty sure that we have not heard the last about security and privacy concerns associated with virtual worlds.
